File name:

34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.exe

Full analysis: https://app.any.run/tasks/a1dcc5a6-b93a-4321-99da-cf5e4906e295
Verdict: Malicious activity
Analysis date: January 08, 2024, 18:40:41
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

7C6F46240579AB8A8CA25BA0A5B2A64D

SHA1:

EEA4A0BCD6AFB8075B4DB984F36A60C847B80D39

SHA256:

34A4F512D7C7E37FC580ABDC8CA4CCE21280E4C33E14C0CA48A0D7AEE9FC7DB9

SSDEEP:

98304:o+QQmFeUj/fhTv2GVZWXEBgf47UaiefalVbOpWG4g1cwI0yKhT+pCPgSzSom6fuX:8Tv2GE9LBFzzD57VkwBZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Scans artifacts that could help determine the target

      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 208)
      • RegCleanPro.exe (PID: 6136)
    • Uses Task Scheduler to run other applications

      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 208)
      • RegCleanPro.exe (PID: 6136)
    • Creates a writable file in the system directory

      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 208)
  • SUSPICIOUS

    • Reads the date of Windows installation

      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 4536)
      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 208)
    • Reads the Windows owner or organization settings

      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 208)
    • Uses TASKKILL.EXE to kill process

      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 208)
    • Reads security settings of Internet Explorer

      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 208)
      • RegCleanPro.exe (PID: 6136)
    • Checks Windows Trust Settings

      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 208)
      • RegCleanPro.exe (PID: 6136)
    • Checks for Java to be installed

      • jusched.exe (PID: 5864)
      • RegCleanPro.exe (PID: 6136)
    • Searches for installed software

      • RegCleanPro.exe (PID: 6136)
    • Adds/modifies Windows certificates

      • RegCleanPro.exe (PID: 6136)
    • Reads Microsoft Outlook installation path

      • RegCleanPro.exe (PID: 6136)
    • Checks for the .NET to be installed

      • RegCleanPro.exe (PID: 6136)
    • Reads the history of recent RDP connections

      • RegCleanPro.exe (PID: 6136)
  • INFO

    • Reads the computer name

      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 4536)
      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 208)
      • RegCleanPro.exe (PID: 1016)
      • RegCleanPro.exe (PID: 720)
      • RCPNotifier.exe (PID: 2480)
      • RegCleanPro.exe (PID: 1380)
      • RegCleanPro.exe (PID: 4780)
      • RCPNotifier.exe (PID: 1508)
      • TextInputHost.exe (PID: 2196)
      • RCPNotifier.exe (PID: 4064)
      • RegCleanPro.exe (PID: 6136)
      • SystemSettings.exe (PID: 4840)
      • RCPNotifier.exe (PID: 3012)
    • Checks supported languages

      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.exe (PID: 4920)
      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 4536)
      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.exe (PID: 2536)
      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 208)
      • RegCleanPro.exe (PID: 720)
      • RegCleanPro.exe (PID: 1016)
      • RCPNotifier.exe (PID: 2480)
      • RegCleanPro.exe (PID: 4780)
      • RegCleanPro.exe (PID: 1380)
      • RCPNotifier.exe (PID: 1508)
      • RCPNotifier.exe (PID: 4064)
      • TextInputHost.exe (PID: 2196)
      • jusched.exe (PID: 5864)
      • RegCleanPro.exe (PID: 6136)
      • SystemSettings.exe (PID: 4840)
      • RCPNotifier.exe (PID: 3012)
    • Drops the executable file immediately after the start

      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.exe (PID: 4920)
      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.exe (PID: 2536)
      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 208)
    • Create files in a temporary directory

      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.exe (PID: 4920)
      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.exe (PID: 2536)
      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 208)
    • Checks proxy server information

      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 208)
      • RegCleanPro.exe (PID: 1016)
      • RegCleanPro.exe (PID: 720)
      • RCPNotifier.exe (PID: 2480)
      • RCPNotifier.exe (PID: 1508)
      • RCPNotifier.exe (PID: 4064)
      • RegCleanPro.exe (PID: 6136)
      • RCPNotifier.exe (PID: 3012)
    • Reads the software policy settings

      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 208)
      • RCPNotifier.exe (PID: 2480)
      • RCPNotifier.exe (PID: 1508)
      • RegCleanPro.exe (PID: 720)
      • RCPNotifier.exe (PID: 4064)
      • RCPNotifier.exe (PID: 3012)
      • RegCleanPro.exe (PID: 6136)
    • Reads the machine GUID from the registry

      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 208)
      • RegCleanPro.exe (PID: 1016)
      • RegCleanPro.exe (PID: 720)
      • RCPNotifier.exe (PID: 2480)
      • RegCleanPro.exe (PID: 1380)
      • RegCleanPro.exe (PID: 4780)
      • RCPNotifier.exe (PID: 1508)
      • RCPNotifier.exe (PID: 4064)
      • RegCleanPro.exe (PID: 6136)
      • RCPNotifier.exe (PID: 3012)
    • Creates files or folders in the user directory

      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 208)
      • RegCleanPro.exe (PID: 1016)
      • RegCleanPro.exe (PID: 1380)
      • RCPNotifier.exe (PID: 2480)
      • RCPNotifier.exe (PID: 1508)
      • RegCleanPro.exe (PID: 6136)
    • Process drops legitimate windows executable

      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 208)
    • Creates files in the program directory

      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 208)
      • RCPNotifier.exe (PID: 2480)
      • RCPNotifier.exe (PID: 1508)
      • RCPNotifier.exe (PID: 4064)
      • MoUsoCoreWorker.exe (PID: 5816)
    • The process drops C-runtime libraries

      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 208)
    • Process checks computer location settings

      • 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp (PID: 208)
    • Reads Environment values

      • RegCleanPro.exe (PID: 1016)
      • RCPNotifier.exe (PID: 2480)
      • RegCleanPro.exe (PID: 720)
      • RCPNotifier.exe (PID: 1508)
      • RCPNotifier.exe (PID: 4064)
      • RegCleanPro.exe (PID: 6136)
      • RCPNotifier.exe (PID: 3012)
    • Manual execution by a user

      • RegCleanPro.exe (PID: 1380)
      • RegCleanPro.exe (PID: 5976)
      • RegCleanPro.exe (PID: 4780)
      • RegCleanPro.exe (PID: 5460)
      • jusched.exe (PID: 5864)
      • RegCleanPro.exe (PID: 6036)
      • RegCleanPro.exe (PID: 6136)
      • MoUsoCoreWorker.exe (PID: 5816)
      • ApplicationFrameHost.exe (PID: 5004)
      • SystemSettings.exe (PID: 4840)
      • UserOOBEBroker.exe (PID: 6000)
      • FileCoAuth.exe (PID: 4892)
      • WmiPrvSE.exe (PID: 5732)
    • The process executes via Task Scheduler

      • RCPNotifier.exe (PID: 1508)
      • RCPNotifier.exe (PID: 4064)
      • RCPNotifier.exe (PID: 3012)
    • Process requests binary or script from the Internet

      • RCPNotifier.exe (PID: 1508)
      • RegCleanPro.exe (PID: 720)
      • RegCleanPro.exe (PID: 6136)
    • Reads the time zone

      • MoUsoCoreWorker.exe (PID: 5816)
    • Reads Microsoft Office registry keys

      • RegCleanPro.exe (PID: 6136)
    • Process checks Powershell version

      • RegCleanPro.exe (PID: 6136)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:05:21 07:56:23+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741376
InitializedDataSize: 465920
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6
ImageVersion: 6
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 8.45.81.1204
ProductVersionNumber: 8.45.81.1204
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Systweak Software
FileDescription: RegClean Pro
FileVersion: 8.45.81.1204
LegalCopyright: © Systweak Software
OriginalFileName: rcpsetupg_.exe
ProductName: RegClean Pro
ProductVersion: 8.45.81.1204
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
310
Monitored processes
59
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start start 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.exe no specs 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp no specs 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.exe 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs regcleanpro.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs regcleanpro.exe rcpnotifier.exe regcleanpro.exe no specs regcleanpro.exe regcleanpro.exe no specs regcleanpro.exe filecoauth.exe no specs rcpnotifier.exe textinputhost.exe no specs rcpnotifier.exe jusched.exe no specs regcleanpro.exe no specs regcleanpro.exe backgroundtaskhost.exe no specs systemsettings.exe no specs applicationframehost.exe no specs mousocoreworker.exe no specs usoclient.exe no specs useroobebroker.exe no specs filecoauth.exe no specs schtasks.exe no specs conhost.exe no specs rcpnotifier.exe wmiprvse.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\Users\admin\AppData\Local\Temp\is-UQCRF.tmp\34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp" /SL5="$801C4,10561098,1208320,C:\Users\admin\Desktop\34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.exe" /SPAWNWND=$9004C /NOTIFYWND=$701F2 C:\Users\admin\AppData\Local\Temp\is-UQCRF.tmp\34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp
34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.exe
User:
admin
Company:
Systweak Software
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-uqcrf.tmp\34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
536\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeschtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
644"C:\Windows\System32\schtasks.exe" /delete /tn "RegClean ProRunAtStartup" /fC:\Windows\SysWOW64\schtasks.exe34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
720"C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe" firstinstallC:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp
User:
admin
Company:
Systweak
Integrity Level:
HIGH
Description:
RegClean Pro
Exit code:
1073807364
Version:
8.45.81.1204
Modules
Images
c:\program files (x86)\regclean pro\regcleanpro.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
792\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeschtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
872"C:\Windows\System32\schtasks.exe" /delete /tn "RegClean Pro_UPDATES" /fC:\Windows\SysWOW64\schtasks.exe34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
892"C:\Windows\System32\taskkill.exe" /f /im "RegCleanPro.exe"C:\Windows\SysWOW64\taskkill.exe34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1016"C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe" loadvaluesC:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp
User:
admin
Company:
Systweak
Integrity Level:
HIGH
Description:
RegClean Pro
Exit code:
666
Version:
8.45.81.1204
Modules
Images
c:\program files (x86)\regclean pro\regcleanpro.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1120"C:\Windows\System32\taskkill.exe" /f /im "RegCleanPro.exe"C:\Windows\SysWOW64\taskkill.exe34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1164"C:\WINDOWS\System32\usoclient.exe" StartStoreUpdatesC:\Windows\System32\UsoClient.exeMoUsoCoreWorker.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
UsoClient
Exit code:
0
Version:
10.0.19041.1266 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\usoclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
Total events
103 925
Read events
103 632
Write events
283
Delete events
10

Modification events

(PID) Process:(208) 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(208) 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(208) 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(208) 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(208) 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(208) 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(208) 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Systweak\RegClean Pro\Version 6.1
Operation:writeName:isphone
Value:
0
(PID) Process:(208) 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Systweak\RegClean Pro\Version 6.1
Operation:writeName:issilent
Value:
1
(PID) Process:(208) 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Systweak\RegClean Pro\Version 6.1
Operation:writeName:CplURL
Value:
http://www.abc.in/?
(PID) Process:(208) 34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Systweak\RegClean Pro\Version 6.1
Operation:writeName:GA
Value:
1
Executable files
130
Suspicious files
29
Text files
90
Unknown types
0

Dropped files

PID
Process
Filename
Type
20834a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmpC:\Users\admin\AppData\Local\Temp\is-5MQRA.tmp\isxdl.dllexecutable
MD5:82201CD8F401F00000B7575B24B3AD0B
SHA256:9D64A934A4A12C61A33342151E674100E1EC0074D106612B1E81244234D93D67
253634a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.exeC:\Users\admin\AppData\Local\Temp\is-UQCRF.tmp\34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmpexecutable
MD5:A3C660CCD6C1EC5B6F35AA5679893561
SHA256:975F8C7E9BD5DCB5EC33BEC68BA380CB64E5DC9C731BEECDEF33527FB5C7CB3C
20834a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmpC:\Users\admin\AppData\Local\Temp\is-5MQRA.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
20834a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmpC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\gethash[1].txttext
MD5:5200E6DA35B9E64901233ED4385417DA
SHA256:A479635EBD22181F8CD40866381B2B9A2A1805A80AAAC3A1950EC22E6B4BCB18
20834a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmpC:\Users\admin\AppData\Roaming\systweak\RegClean Pro\hash.initext
MD5:5200E6DA35B9E64901233ED4385417DA
SHA256:A479635EBD22181F8CD40866381B2B9A2A1805A80AAAC3A1950EC22E6B4BCB18
20834a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmpC:\Program Files (x86)\RegClean Pro\is-5EN80.tmpexecutable
MD5:A3C660CCD6C1EC5B6F35AA5679893561
SHA256:975F8C7E9BD5DCB5EC33BEC68BA380CB64E5DC9C731BEECDEF33527FB5C7CB3C
20834a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmpC:\Users\admin\AppData\Local\Temp\is-5MQRA.tmp\is-H7TDM.tmpimage
MD5:C65976E521F9EA79B773B106FC445540
SHA256:FB934332692DA92C12BE90ACF616F9D5A7632B847540D2E141E1A22C3D459A26
492034a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.exeC:\Users\admin\AppData\Local\Temp\is-A4ED2.tmp\34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmpexecutable
MD5:A3C660CCD6C1EC5B6F35AA5679893561
SHA256:975F8C7E9BD5DCB5EC33BEC68BA380CB64E5DC9C731BEECDEF33527FB5C7CB3C
20834a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmpC:\Program Files (x86)\RegClean Pro\unins000.exeexecutable
MD5:A3C660CCD6C1EC5B6F35AA5679893561
SHA256:975F8C7E9BD5DCB5EC33BEC68BA380CB64E5DC9C731BEECDEF33527FB5C7CB3C
20834a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmpC:\Users\admin\AppData\Local\Temp\is-5MQRA.tmp\bullet.bmpimage
MD5:C65976E521F9EA79B773B106FC445540
SHA256:FB934332692DA92C12BE90ACF616F9D5A7632B847540D2E141E1A22C3D459A26
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
61
TCP/UDP connections
67
DNS requests
32
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
208
34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp
GET
404
5.79.122.22:80
http://track.activate123.com/rcpip/tempfile/3237964978
unknown
html
1.22 Kb
2908
svchost.exe
GET
200
2.19.105.18:80
http://x1.c.lencr.org/
unknown
binary
717 b
1016
RegCleanPro.exe
GET
165.227.176.158:80
http://activate123.com/rcp/update.asp?utm_source=4a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9&utm_campaign=4a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9&utm_medium=newbuild&pxl=rcp_def_pixel&affiliate=&hid=7139557631536884893&langcode=en&isreg=0&isexpired=0&productid=13271&appversion=8.45.81.1204&utm_cid=&utm_updt=&utm_updatedate=&utm_days=0&utm_nagdays=0&os=microsoft+windows+10+enterprise&ri=0
unknown
720
RegCleanPro.exe
GET
142.250.185.228:80
http://www.google.com/
unknown
5964
SIHClient.exe
GET
304
13.85.23.86:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19044.1288/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.1288&MK=DELL&MD=DELL
unknown
720
RegCleanPro.exe
GET
200
103.235.46.40:80
http://www.baidu.com/
unknown
html
9.29 Kb
1508
RCPNotifier.exe
GET
200
142.250.185.228:80
http://www.google.com/
unknown
html
50.0 Kb
1508
RCPNotifier.exe
GET
200
5.79.122.22:443
https://offers.systweak.com/win/rcp/notifier/notifier_rcp.json
unknown
1508
RCPNotifier.exe
GET
200
142.250.185.228:80
http://www.google.com/
unknown
html
50.5 Kb
POST
204
104.126.37.163:443
https://www.bing.com/threshold/xls.aspx
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
239.255.255.250:1900
unknown
4552
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
208
34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp
23.108.29.119:443
www.systweak.com
LEASEWEB-USA-NYC
US
unknown
5612
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4188
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5612
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4
System
192.168.100.255:137
unknown
208
34a4f512d7c7e37fc580abdc8ca4cce21280e4c33e14c0ca48a0d7aee9fc7db9.tmp
5.79.122.22:80
track.activate123.com
LeaseWeb Netherlands B.V.
NL
unknown
2908
svchost.exe
2.19.105.18:80
x1.c.lencr.org
AKAMAI-AS
DE
unknown
1016
RegCleanPro.exe
165.227.176.158:80
activate123.com
DIGITALOCEAN-ASN
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
  • 20.73.194.208
unknown
www.systweak.com
  • 23.108.29.119
unknown
track.activate123.com
  • 5.79.122.22
unknown
x1.c.lencr.org
  • 2.19.105.18
unknown
activate123.com
  • 165.227.176.158
unknown
self.events.data.microsoft.com
  • 20.42.65.85
  • 20.189.173.23
unknown
www.google.com
  • 142.250.185.228
  • 142.250.186.68
  • 142.250.181.228
unknown
www.baidu.com
  • 103.235.46.40
unknown
slscr.update.microsoft.com
  • 52.165.165.26
unknown
offers.systweak.com
  • 5.79.122.22
unknown

Threats

PID
Process
Class
Message
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
Process
Message
RegCleanPro.exe
value: The key {0} points to the missing ApplicationID {1}. Key , IDS_PROBLEM_DETAIL_6, IDS_PROBLEM_DETAIL_20 value: The key {0} points to the missing CLSID {1}. Key , IDS_PROBLEM_DETAIL_24, IDS_PROBLEM_DETAIL_43, IDS_PROBLEM_DETAIL_44 value: The registry contains an entry for the font {0} under {1} that points to the missing file {2}. Key , IDS_PROBLEM_DETAIL_32, IDS_PROBLEM_DETAIL_33 value: The Windows history list contains a reference to the missing file {0}. This invalid entry can be deleted. Key , IDS_PROBLEM_DESC_3, IDS_PROBLEM_DESC_7 value: This object points to the missing ApplicationID {0}. Key , IDS_PROBLEM_DESC_9, IDS_PROBLEM_DESC_10 value: The subkey {0} for this type library contains no data. Key , IDS_PROBLEM_DESC_25, IDS_PROBLEM_DESC_26, IDS_PROBLEM_DESC_28, IDS_PROBLEM_DESC_32, IDS_PROBLEM_DESC_33, IDS_PROBLEM_DESC_34 value: The file could not be found in the indicated folder {0}. Key , IDS_PROBLEM_DESC_43, IDS_PROBLEM_DESC_44 value: The Key value {0} in the key {1} points to a missing file {2}.
RegCleanPro.exe
Key , IDS_DU_APP_NAME, DPF_PREFERENCES_MAIN_TITLE_TEXT, 100 value: RegClean Pro Key , IDS_LANGUAGES, IDS_SET_LANGUAGES value: Languages Key , IDS_SETTINGS, DPF_MAINBORDER_UC_SETTINGS_TEXT, DPF_PREFERENCES_MAIN_TITLE_SETTINGS_TEXT, IDS_BTN_SETTINGS value: Settings Key , IDS_HELP, DPF_MAINBORDER_UC_HELP_TEXT, DPF_MAINBORDER_UC_HELPLINK_TEXT, IDS_MARKFILES_HELP, IDS_BTN_HELP value: Help Key , IDS_ENTER_REGISTRATIONKEY, DPF_FOOTER_UC_ENTER_REGISTRATION_KEY, DPF_MAINBORDER_UC_REGISTER_TEXT value: Enter Registration Key Key , IDS_CHK_FOR_UPDATES, DPF_MAINBORDER_UC_CHECK_UPDATE_TEXT value: Check for updates Key , IDS_BTN_ABOUT, DPF_MAINBORDER_UC_ABOUTLINK_TEXT value: About Key , IDS_ERRORCOUNTS_MBAM, IDS_ERRORCOUNTS_STATUS_MBAM value: {0} registry items found Key , IDS_UPDATOR_CANCEL, IDS_CANCEL, DPF_MESSAGEBOX_CANCEL_TEXT, DPF_PROGRESS_CANCEL_TEXT, DFP_UPDATE_CANCEL, IDS_MARKFILES_CANCEL, IDS_BTN_CANCEL, 167 value: Cancel Key , IDS_EMPTY, IDS_MARKFILES_FREE_VERSION_MSG value: Key , IDS_REMOVE, DPF_PREFERENCES_EXCLUSION_REMOVE_TEXT, IDS_MARKFILES_BTN_REMOVE_PROTECTED_FOLDERS, IDS_MARKFILES_BTN_REMOVE_PROTECTED_ALBUMS value: Remove Key , IDC_BC_TRYITNOW, IDS_UTILITY_KIT_TRYITNOW value: Try it Now Key , IDS_UPDATEOFFER_BTN1, IDS_ADU_BUTTON, IDS_DPF_BUTTON value: INSTALL NOW Key , PKS_PB_DOWNLOADNOW, IDS_SBTNDOWNLOADNOW value: Download Now Key , DPF_CGLOBALSETTINGS_HINT_NO_PHOTOS, DPF_HOME_UC_HINT_TEXT value: Hint: Drag photos, folders with your photos from Explorer to scan for similar photos Key , DPF_PROCESSED, DPF_PROCESSOR_PROCESSED, DPF_RESULT_PROCESSED value: {0} processed Key , DPF_ABOUT_VERSION, RCP_SCANREG_SCANDATETIME_TEXT value: {0} Key , DPF_ABOUT_WARNING, IDS_ABOUT_WARNING value: Warning: This computer program is protected by copyright law and international treaties. Unauthorized reproduction or distribution of this program, or any portion of it, may result in severe civil and criminal penalties, and will be prosecuted to the maximum extent possible under the law. Key , DPF_IMAGEINFO_UC_MATCHING_LEVEL, DPF_MESSAGE_UC_MATCHING_LEVEL_TEXT value: Matching Level : Key , DPF_SETTINGS_UC_TIME_INTERVAL_MORE, DPF_SETTINGS_UC_GPS_MORE value: More Key , DPF_SETTINGS_UC_TIME_INTERVAL_LESS, DPF_SETTINGS_UC_GPS_LESS value: Less Key , DPF_FOOTER_UC_BUY_NOW, DPF_REGISTRATION_BUY_NOW, DPF_TRIAL_UPGRADE_NOW, IDS_BTN_TXT value: Upgrade Now Key , IDS_INSTALLSATUS_NOT_INSTALLED, IDC_BTN_INSTALL value: Install Now Key , DPF_RESULT_UC_AUTO_MARK_TEXT, DPF_PREFERENCES_AUTO_MARK_TEXT, DPF_PHOTO_RENDERER_CONTEXTMENU_AUTO_MARK value: Auto Mark Key , DPF_RESULT_SELECTION_ASSISTANT_TEXT, IDS_MARKFILES_FORM_TEXT value: Selection Assistant Key , DPF_MESSAGEBOX_OK_TEXT, IDS_BTN_OK, 168 value: OK Key , DPF_PREFERENCES_GENERAL_TEXT, DPF_PREFERENCES_GENERAL_HEADING_TEXT, IDS_MARKFILES_TABPAGE_GENERAL, IDS_GEN_SETTINGS value: General Key , DPF_PREFERENCES_FILTER_SORT_USE_TEXT, DPF_PREFERENCES_AUTO_MARK_USE_TEXT value: Use Key , DPF_PREFERENCES_EXCLUSION_ADD_TEXT, IDS_MARKFILES_BTN_FOLDER_PRIORITY_ADD, IDS_MARKFILES_BTN_NEW_RULE_FOR_PROTECTED_FOLDERS, IDS_MARKFILES_BTN_ADD_PROTECTED_ALBUMS value: Add Key , DPF_REGISTRATION_LICENSE_KEY_TEXT, IDS_LICENSECODE value: License Key: Key , DPF_REGISTRATION_REGISTER_NOW_TEXT, IDS_BTN_REGISTER_NOW, IDS_REG_NOW value: Register Now Key , PKS_STR_RECOMMEND_UPGRADE, IDS_STR_RECOMMEND_UPGRADE value: We recommend that you upgrade to the full version of Key , DPF_PHOTO_RENDERER_CONTEXTMENU_MARK_PHOTOS, IDS_RESULT_OLV_MARK, IDS_MARKFILES_MARK value: Mark Key , DPF_PHOTO_RENDERER_CONTEXTMENU_SELECT_ALL, IDS_SELECT_ALL, ID_SELECTION_SELECT_ALL value: Select All Key , IDS_MARKFILES_TABPAGEFOLDER, IDS_MARKFILES_FOLDER value: Folder Key , IDS_BTN_BACKUP_REG, IDS_HEADING_BACKUP_REGISTRY value: Backup Registry Key , IDS_BTN_HOME, STRING21 value: Status Key , IDS_ERRORCOUNTS, IDS_ERRORCOUNTS_STATUS value: {0} registry issues found Key , PKS_PP, IDS_PRIVICYP value: Privacy Policy Key , IDS_UNINSTALLI, PKS_UI value: Uninstall Instructions Key , IDS_PROBLEM_DETAIL_3, IDS_PROBLEM_DETAIL_7
RegCleanPro.exe
value: The key {0} points to the missing ApplicationID {1}. Key , IDS_PROBLEM_DETAIL_6, IDS_PROBLEM_DETAIL_20 value: The key {0} points to the missing CLSID {1}. Key , IDS_PROBLEM_DETAIL_24, IDS_PROBLEM_DETAIL_43, IDS_PROBLEM_DETAIL_44 value: The registry contains an entry for the font {0} under {1} that points to the missing file {2}. Key , IDS_PROBLEM_DETAIL_32, IDS_PROBLEM_DETAIL_33 value: The Windows history list contains a reference to the missing file {0}. This invalid entry can be deleted. Key , IDS_PROBLEM_DESC_3, IDS_PROBLEM_DESC_7 value: This object points to the missing ApplicationID {0}. Key , IDS_PROBLEM_DESC_9, IDS_PROBLEM_DESC_10 value: The subkey {0} for this type library contains no data. Key , IDS_PROBLEM_DESC_25, IDS_PROBLEM_DESC_26, IDS_PROBLEM_DESC_28, IDS_PROBLEM_DESC_32, IDS_PROBLEM_DESC_33, IDS_PROBLEM_DESC_34 value: The file could not be found in the indicated folder {0}. Key , IDS_PROBLEM_DESC_43, IDS_PROBLEM_DESC_44 value: The Key value {0} in the key {1} points to a missing file {2}.
RegCleanPro.exe
Key , IDS_DU_APP_NAME, DPF_PREFERENCES_MAIN_TITLE_TEXT, 100 value: RegClean Pro Key , IDS_LANGUAGES, IDS_SET_LANGUAGES value: Languages Key , IDS_SETTINGS, DPF_MAINBORDER_UC_SETTINGS_TEXT, DPF_PREFERENCES_MAIN_TITLE_SETTINGS_TEXT, IDS_BTN_SETTINGS value: Settings Key , IDS_HELP, DPF_MAINBORDER_UC_HELP_TEXT, DPF_MAINBORDER_UC_HELPLINK_TEXT, IDS_MARKFILES_HELP, IDS_BTN_HELP value: Help Key , IDS_ENTER_REGISTRATIONKEY, DPF_FOOTER_UC_ENTER_REGISTRATION_KEY, DPF_MAINBORDER_UC_REGISTER_TEXT value: Enter Registration Key Key , IDS_CHK_FOR_UPDATES, DPF_MAINBORDER_UC_CHECK_UPDATE_TEXT value: Check for updates Key , IDS_BTN_ABOUT, DPF_MAINBORDER_UC_ABOUTLINK_TEXT value: About Key , IDS_ERRORCOUNTS_MBAM, IDS_ERRORCOUNTS_STATUS_MBAM value: {0} registry items found Key , IDS_UPDATOR_CANCEL, IDS_CANCEL, DPF_MESSAGEBOX_CANCEL_TEXT, DPF_PROGRESS_CANCEL_TEXT, DFP_UPDATE_CANCEL, IDS_MARKFILES_CANCEL, IDS_BTN_CANCEL, 167 value: Cancel Key , IDS_EMPTY, IDS_MARKFILES_FREE_VERSION_MSG value: Key , IDS_REMOVE, DPF_PREFERENCES_EXCLUSION_REMOVE_TEXT, IDS_MARKFILES_BTN_REMOVE_PROTECTED_FOLDERS, IDS_MARKFILES_BTN_REMOVE_PROTECTED_ALBUMS value: Remove Key , IDC_BC_TRYITNOW, IDS_UTILITY_KIT_TRYITNOW value: Try it Now Key , IDS_UPDATEOFFER_BTN1, IDS_ADU_BUTTON, IDS_DPF_BUTTON value: INSTALL NOW Key , PKS_PB_DOWNLOADNOW, IDS_SBTNDOWNLOADNOW value: Download Now Key , DPF_CGLOBALSETTINGS_HINT_NO_PHOTOS, DPF_HOME_UC_HINT_TEXT value: Hint: Drag photos, folders with your photos from Explorer to scan for similar photos Key , DPF_PROCESSED, DPF_PROCESSOR_PROCESSED, DPF_RESULT_PROCESSED value: {0} processed Key , DPF_ABOUT_VERSION, RCP_SCANREG_SCANDATETIME_TEXT value: {0} Key , DPF_ABOUT_WARNING, IDS_ABOUT_WARNING value: Warning: This computer program is protected by copyright law and international treaties. Unauthorized reproduction or distribution of this program, or any portion of it, may result in severe civil and criminal penalties, and will be prosecuted to the maximum extent possible under the law. Key , DPF_IMAGEINFO_UC_MATCHING_LEVEL, DPF_MESSAGE_UC_MATCHING_LEVEL_TEXT value: Matching Level : Key , DPF_SETTINGS_UC_TIME_INTERVAL_MORE, DPF_SETTINGS_UC_GPS_MORE value: More Key , DPF_SETTINGS_UC_TIME_INTERVAL_LESS, DPF_SETTINGS_UC_GPS_LESS value: Less Key , DPF_FOOTER_UC_BUY_NOW, DPF_REGISTRATION_BUY_NOW, DPF_TRIAL_UPGRADE_NOW, IDS_BTN_TXT value: Upgrade Now Key , IDS_INSTALLSATUS_NOT_INSTALLED, IDC_BTN_INSTALL value: Install Now Key , DPF_RESULT_UC_AUTO_MARK_TEXT, DPF_PREFERENCES_AUTO_MARK_TEXT, DPF_PHOTO_RENDERER_CONTEXTMENU_AUTO_MARK value: Auto Mark Key , DPF_RESULT_SELECTION_ASSISTANT_TEXT, IDS_MARKFILES_FORM_TEXT value: Selection Assistant Key , DPF_MESSAGEBOX_OK_TEXT, IDS_BTN_OK, 168 value: OK Key , DPF_PREFERENCES_GENERAL_TEXT, DPF_PREFERENCES_GENERAL_HEADING_TEXT, IDS_MARKFILES_TABPAGE_GENERAL, IDS_GEN_SETTINGS value: General Key , DPF_PREFERENCES_FILTER_SORT_USE_TEXT, DPF_PREFERENCES_AUTO_MARK_USE_TEXT value: Use Key , DPF_PREFERENCES_EXCLUSION_ADD_TEXT, IDS_MARKFILES_BTN_FOLDER_PRIORITY_ADD, IDS_MARKFILES_BTN_NEW_RULE_FOR_PROTECTED_FOLDERS, IDS_MARKFILES_BTN_ADD_PROTECTED_ALBUMS value: Add Key , DPF_REGISTRATION_LICENSE_KEY_TEXT, IDS_LICENSECODE value: License Key: Key , DPF_REGISTRATION_REGISTER_NOW_TEXT, IDS_BTN_REGISTER_NOW, IDS_REG_NOW value: Register Now Key , PKS_STR_RECOMMEND_UPGRADE, IDS_STR_RECOMMEND_UPGRADE value: We recommend that you upgrade to the full version of Key , DPF_PHOTO_RENDERER_CONTEXTMENU_MARK_PHOTOS, IDS_RESULT_OLV_MARK, IDS_MARKFILES_MARK value: Mark Key , DPF_PHOTO_RENDERER_CONTEXTMENU_SELECT_ALL, IDS_SELECT_ALL, ID_SELECTION_SELECT_ALL value: Select All Key , IDS_MARKFILES_TABPAGEFOLDER, IDS_MARKFILES_FOLDER value: Folder Key , IDS_BTN_BACKUP_REG, IDS_HEADING_BACKUP_REGISTRY value: Backup Registry Key , IDS_BTN_HOME, STRING21 value: Status Key , IDS_ERRORCOUNTS, IDS_ERRORCOUNTS_STATUS value: {0} registry issues found Key , PKS_PP, IDS_PRIVICYP value: Privacy Policy Key , IDS_UNINSTALLI, PKS_UI value: Uninstall Instructions Key , IDS_PROBLEM_DETAIL_3, IDS_PROBLEM_DETAIL_7
RCPNotifier.exe
UTM_CAMPAIGN
RCPNotifier.exe
AFFILIATEID
RCPNotifier.exe
UTM_SOURCE
RCPNotifier.exe
UTM_MEDIUM
RCPNotifier.exe
ISREG
RCPNotifier.exe
ISEXPIRED